Skip to main content

Linux Kernel EUVDEUVD-2026-53784

| CVE-2026-64597 CRITICAL
2026-08-06 Linux GHSA-4vgx-hp6g-jmm8
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Requires the victim to mount an attacker-controlled SMB server (UI:R) and a specific replay/error race (AC:H); the double-free most reliably yields a kernel crash (A:H) with limited memory disclosure (C:L/I:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:39 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Aug 06, 2026 - 08:16 EUVD
CVE Published
Aug 06, 2026 - 07:13 cve.org
CRITICAL 9.8
CVE Published
Aug 06, 2026 - 07:13 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix double-free in SMB2_close() replay

A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again.

Reset response bookkeeping before each attempt to prevent the stale free.

AnalysisAI

Memory corruption (double-free) in the Linux kernel's SMB/CIFS client SMB2_close replay path can be triggered when a mounted SMB server returns a replayable error and a subsequent SMB2_close_init() fails, causing the same response buffer to be freed twice. It affects Linux stable kernels across the 6.6.x through 7.x series before the fixed releases; while the CNA-assigned CVSS is 9.8 with no public exploit identified at time of analysis, real-world abuse requires the victim host to communicate with a malicious or compromised SMB server, making this primarily a client-side memory-corruption/DoS concern rather than trivial remote code execution.

Technical ContextAI

The flaw lives in fs/smb/client (the in-kernel cifs.ko SMB2/3 client) in the request-replay logic used when a server signals a retriable/replayable error. In SMB2_close(), a response-bearing attempt can return a replayable error and free its response buffer; if SMB2_close_init() then fails before the next send, the cleanup path still references the previous buffer type and frees the already-freed response a second time. This is a classic CWE-415 double-free (the CVE record lists CWE as N/A and the vendor tags it 'Information Disclosure', but the root cause is a use-after-free/double-free of heap memory). The fix resets the response bookkeeping (buffer pointer and buffer type) before each replay attempt so stale state cannot be freed again. The affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline kernel's SMB client subsystem, exercised whenever a Linux host mounts an SMB share.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 or later on the corresponding series - or apply the upstream fix commits from git.kernel.org (e.g. f96e1cdcb63ed3321142ff2fcdf784e32cda8fee and the stable backports 037511726228aaf165c7067ff2bfc88eaecdf1f3, 0aa97edf7c347c0f54e7e60c4740574b8120c66a, d15d83125007f673aec4323e1bbbaaffbe87ea13, b18ed621dbfceecea5539848cddcb9272c9a61e1) and rebuild, or install the corresponding distribution kernel update; see https://nvd.nist.gov/vuln/detail/CVE-2026-64597. Where immediate patching is not possible, reduce exposure by not mounting SMB/CIFS shares from untrusted or attacker-controllable servers and restricting outbound SMB (TCP 445) to known-good file servers, which prevents a hostile server from returning the crafted replayable errors - the trade-off is loss of ad-hoc SMB connectivity. If the cifs client is not needed on a host, blacklisting/unloading the cifs kernel module removes the attack surface entirely, at the cost of disabling SMB mounts on that machine.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-53784 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy